dmarc-ingest: what is not a report this relay keeps is dropped, not retried

Owner, 2026-10-11: foreign and malformed reports are turned away.

The command answered every failure with EX_TEMPFAIL, so Postfix kept a
message that could never be stored and offered it again for days, each
attempt adding to the parse-failure count. IngestMessage now marks those
failures (unreadable as an aggregate report, a domain not sent from
here, another domain's report address) with ErrRejected; the command
counts one failure, writes the reason where Postfix puts it on the delivery line of the mail log
and reports the delivery as done. No bounce: the envelope sender of such
a message is whatever its author wrote, and the report addresses are
public. A failing store is still EX_TEMPFAIL.

  go vet ./cmd/... ./internal/dmarc/: ok
  go test ./cmd/panel/ ./internal/dmarc/ ./internal/web/...: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/dmarc_ingest.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -28,14 +29,31 @@ func runDMARCIngestMode() error {
 
 	recipient := ingestRecipient(os.Args[1:])
 	if err := dmarc.IngestMessage(st, io.LimitReader(os.Stdin, maxIngestStdin), recipient, time.Now().UTC()); err != nil {
+		if !errors.Is(err, dmarc.ErrRejected) {
+			return err
+		}
+		// Not a report this relay keeps. It is dropped: deferring would have
+		// Postfix try it again for days, and a bounce would go to an envelope
+		// sender anyone can write - the report addresses are public.
 		if incrErr := st.IncrDMARCParseFailures(); incrErr != nil {
 			log.Printf("dmarc ingest: record failure: %v", incrErr)
 		}
-		return err
+		logRejected(err)
 	}
 	return nil
 }
 
+// logRejected leaves the reason in the mail log. Postfix puts the start of
+// what a delivery command wrote - about a hundred bytes - into its own line
+// for the message ("status=sent (delivered via dmarc-ingest service (...))"),
+// so the reason goes out first and bare: no prefix, no date, no recipient,
+// all of which that line already has. postlog is no use here: pipe(8) starts
+// the command without the group that may write to Postfix's log socket.
+func logRejected(reason error) {
+	text := strings.TrimPrefix(reason.Error(), dmarc.ErrRejected.Error()+": ")
+	fmt.Fprintln(os.Stderr, "dropped: "+text)
+}
+
 // ingestRecipient is the report address the message was delivered to. Postfix's
 // pipe(8) hands it over as an argument (${recipient} in the service's argv,
 // build/postfix-config.sh) - it sets no RECIPIENT variable, that is local(8).